Google Account App Access: How to Audit Third-Party Apps

Every time you click "Sign in with Google" or let an app read your calendar, you hand out a key. Most of those keys are harmless, but they rarely expire on their own, and many people have apps from five or ten years ago still holding access to their email. On October 30, 2026, Google published a short reminder urging users to check who, or what, can reach their Gmail inbox, and it is a good excuse to build a habit. This guide walks through a complete Google Account app access audit, explains what the permissions actually mean, and shows how to keep the list clean going forward.

• Time needed: about 2 minutes for a basic check, according to Google, or 10 to 15 minutes for a thorough audit
• Where to start: Google's Security Checkup at myaccount.google.com/security-checkup
• Three core steps: review signed-in devices, remove old third-party app access, and confirm recovery information
• Best habit: repeat the audit every few months, and right after you stop using any connected service

Quick Picks: The Fastest Wins

If you only have a few minutes, do these in order:

• Run Security Checkup and act on every item it flags, since it surfaces the highest-risk issues first
• Remove any app you do not recognize or have not used in the past year, especially ones with Gmail or Drive access
• Sign out of old devices, like a phone you sold or a laptop from a previous job
• Confirm your recovery phone and email so you can always get back in
• Add a passkey if you have not already, so phishing a password is no longer enough to take over the account

Why Does Third-Party App Access Matter?

When you connect an app to your Google Account, you usually do it through a standard authorization flow. Instead of giving the app your password, Google issues it a token with a defined set of permissions, called scopes. That design is a genuine security win: the app never sees your password, and you can revoke its access at any time without changing anything else.

The catch is persistence. A token can keep working long after you have forgotten the app exists. If that developer is later acquired, abandons the product, or suffers a breach, the access you granted years ago is still there. Attackers know this, which is why consent phishing exists: rather than stealing a password, a fake app simply asks you to approve broad access to your mail or files.

Auditing your connections closes that gap. It is one of the highest-value, lowest-effort security tasks you can do, and it protects everything connected to your inbox, from password resets to bank alerts.

How Do I Run a Google Security Checkup?

Google's Security Checkup is the best starting point because it pulls the most important settings into one guided page. Visit myaccount.google.com/security-checkup while signed in, or open your Google Account settings and choose the Security section. Google's October 30 post highlights three steps.

Step 1: Review Signed-In Devices

Look through the list of phones, tablets and computers currently signed in to your account. For each one, ask whether you still own it and still use it. Sign out of anything you do not recognize or no longer have, such as a traded-in phone, a shared family computer, or a work laptop you returned. If something looks unfamiliar, sign it out and then change your password as a precaution.

Step 2: Remove Old Third-Party App Access

This is the heart of the audit. You will see the apps and services that have access to your Google Account data. Work through them one at a time:

• Do you recognize it? If not, remove its access
• Have you used it in the past year? If not, remove it. You can always reconnect later
• Does the access match the purpose? A to-do app that needs your calendar is reasonable; a wallpaper app that can read your email is not

Removing access does not delete your account with that service. It simply revokes the token, so the app can no longer reach your Google data until you sign in and approve it again.

Step 3: Confirm Recovery Information

Make sure your recovery phone number and recovery email are current. These are your lifeline if you ever lose access, and an out-of-date recovery number is one of the most common reasons people get locked out after a scare. While you are here, check that a recovery email is not an old address you no longer control.

Which App Permissions Are Most Sensitive?

Not all access is equal. When you review connected apps, pay closest attention to anything that can read, send or delete data. In rough order of sensitivity:

• Full Gmail access: reading, sending or deleting email gives an app a view of password resets and personal conversations
• Google Drive access to all files: broader than access to only the files you open with that app
• Contacts: exposes other people's information, not just yours
• Calendar: reveals your schedule and meeting links
• Basic sign-in information: "Sign in with Google" typically shares only your name, email address and profile picture, which is far lower risk

A good rule of thumb is least privilege: an app should have only the access it needs to do its job. If a service asks for more than that, it is reasonable to look for an alternative that asks for less.

How Often Should I Audit Connected Apps?

For most people, every three to six months is plenty. Add a reminder alongside other routine tasks, like checking your credit report or backing up your phone. There are also natural trigger moments:

• After you stop using a service, revoke its access the same day
• After a breach announcement involving any app you have connected
• When you change jobs, since work tools often get connected to personal accounts
• Before you sell or give away a device

If you manage accounts for family members, consider doing their audit together. It is a five-minute conversation that can prevent a very bad week.

Does This Apply to Microsoft, Apple and Other Accounts?

Yes. The same idea applies to any account that lets other apps sign in or connect: Microsoft, Apple, GitHub, social networks and password managers all keep lists of authorized apps and signed-in devices. The vocabulary differs, but the process is the same: find the list of connected apps, remove what you do not use, sign out of old devices, and confirm your recovery options. If you have recently moved work accounts away from text-message codes, our guide to moving Microsoft Entra ID users from SMS to passkeys pairs well with this checklist.

How Do Passkeys Strengthen Account Security?

Cleaning up app access reduces what an attacker can reach through third parties. Passkeys protect the front door. A passkey replaces your password with a cryptographic credential stored on your phone, computer or security key, unlocked by your fingerprint, face or device PIN. Because there is no password to type, there is nothing for a fake login page to capture, which shuts down the most common form of phishing.

Google supports passkeys for personal accounts, and setting one up takes a minute or two from the Security section of your account. Keep your password and recovery options as a backup, and add passkeys on each device you use regularly.

Spotting Consent Phishing Before You Click Allow

The best audit is the one you never need. When an app asks for access, slow down for three seconds and check:

• Who is asking? Make sure the app name and developer match what you expect
• What is it asking for? Be wary of any app that wants to read, send or delete all your email without a clear reason
• Where did the request come from? A permission prompt that appears after clicking a link in an unexpected email deserves extra suspicion

If something feels off, close the window. A legitimate app will still be there after you verify it independently. The same instinct helps with other modern scams, like the voice-clone calls covered in our family safe word guide.

Make It a Habit

Security does not have to be dramatic to be effective. A two-minute checkup, done a few times a year, removes forgotten access, keeps your recovery details current, and makes your account a much less attractive target. Bookmark the Security Checkup page, set a calendar reminder, and treat it like rotating the batteries in a smoke detector. For more practical defense guides, explore our AI security coverage.

Sources: Google, The Keyword: See who has access to your Gmail inbox — October 30, 2026; Google Security Checkup — accessed October 30, 2026; Google, The Keyword: How to set up a passkey — accessed October 30, 2026; Gmail Help Center — accessed October 30, 2026.